neko-harness 0.4.0 → 0.4.2

package/dist/neko.js

@@ -80,7 +80,7 @@ function updateAction(input) {
     return "install";
   return "none";
 }
-var RUNNING_VERSION = "0.4.0", APPLICATION_PROTOCOL = 4, ApplicationProtocolError;
+var RUNNING_VERSION = "0.4.2", APPLICATION_PROTOCOL = 4, ApplicationProtocolError;
 var init_application_version = __esm(() => {
   ApplicationProtocolError = class ApplicationProtocolError extends Error {
     constructor() {
@@ -20276,7 +20276,9 @@ var init_admin = __esm(() => {
     Type6.Object({
       status: Type6.Literal("listening"),
       address: Type6.String(),
-      port: Type6.Integer({ minimum: 1, maximum: 65535 })
+      port: Type6.Integer({ minimum: 1, maximum: 65535 }),
+      bindAddress: Type6.Optional(Type6.String()),
+      mode: Type6.Optional(Type6.Union([Type6.Literal("direct"), Type6.Literal("wsl-relay")]))
     }),
     Type6.Object({ status: Type6.Literal("error"), error: Type6.String() }),
     Type6.Object({ status: Type6.Literal("stopping") })
@@ -20305,7 +20307,11 @@ var init_admin = __esm(() => {
                 Type6.Null()
               ]),
               devices: Type6.Array(adminDeviceSchema),
-              lastConnectedAddress: Type6.Union([Type6.String(), Type6.Null()])
+              lastConnectedAddress: Type6.Union([Type6.String(), Type6.Null()]),
+              wsl: Type6.Optional(Type6.Union([
+                Type6.Object({ interop: Type6.Boolean(), error: Type6.Union([Type6.String(), Type6.Null()]) }),
+                Type6.Null()
+              ]))
             })
           ],
           enable: [
@@ -20316,7 +20322,9 @@ var init_admin = __esm(() => {
             Type6.Object({
               status: Type6.Literal("listening"),
               address: Type6.String(),
-              port: Type6.Integer({ minimum: 1, maximum: 65535 })
+              port: Type6.Integer({ minimum: 1, maximum: 65535 }),
+              bindAddress: Type6.Optional(Type6.String()),
+              mode: Type6.Optional(Type6.Union([Type6.Literal("direct"), Type6.Literal("wsl-relay")]))
             })
           ],
           disable: [Type6.Null(), listenerStateSchema],
@@ -38553,6 +38561,73 @@ var init_certificate = __esm(() => {
   CERT_VALIDITY_MS = 825 * 24 * 60 * 60 * 1000;
 });
 
+// packages/gateway/src/mobile/network.ts
+import { networkInterfaces } from "os";
+function isVirtualInterfaceName(name) {
+  const lower = name.toLowerCase();
+  if (VIRTUAL_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix)))
+    return true;
+  return VIRTUAL_INTERFACE_KEYWORDS.some((keyword) => lower.includes(keyword));
+}
+function isBenchmarkAddress(address) {
+  return address.startsWith("198.18.") || address.startsWith("198.19.");
+}
+function collectListenCandidates(interfaces, skipVirtual) {
+  const candidates = [];
+  for (const [name, infos] of Object.entries(interfaces)) {
+    if (infos === undefined)
+      continue;
+    if (skipVirtual && isVirtualInterfaceName(name))
+      continue;
+    for (const info of infos) {
+      if (info.family !== "IPv4" || info.internal)
+        continue;
+      if (info.address.startsWith("169.254."))
+        continue;
+      if (skipVirtual && isBenchmarkAddress(info.address))
+        continue;
+      candidates.push(info.address);
+    }
+  }
+  return candidates.sort();
+}
+function mobileListenCandidates(interfaces) {
+  const source = interfaces ?? networkInterfaces();
+  const filtered = collectListenCandidates(source, true);
+  return filtered.length > 0 ? filtered : collectListenCandidates(source, false);
+}
+function prioritizeListenCandidate(candidates, lastConnectedAddress) {
+  if (lastConnectedAddress === null || !candidates.includes(lastConnectedAddress))
+    return [...candidates];
+  return [lastConnectedAddress, ...candidates.filter((candidate) => candidate !== lastConnectedAddress)];
+}
+function isIpv4Literal(address) {
+  const parts = address.split(".");
+  return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+var VIRTUAL_INTERFACE_PREFIXES, VIRTUAL_INTERFACE_KEYWORDS;
+var init_network = __esm(() => {
+  VIRTUAL_INTERFACE_PREFIXES = [
+    "anpi",
+    "awdl",
+    "bridge",
+    "docker",
+    "gif",
+    "ipsec",
+    "llw",
+    "ppp",
+    "stf",
+    "tap",
+    "tun",
+    "utun",
+    "vboxnet",
+    "veth",
+    "virbr",
+    "vmnet"
+  ];
+  VIRTUAL_INTERFACE_KEYWORDS = ["hyper-v", "virtual", "virtualbox", "vmware", "vpn", "wsl"];
+});
+
 // packages/gateway/src/mobile/pairing.ts
 import { createHash as createHash5, randomBytes as randomBytes3 } from "crypto";
 function sha256Hex2(value) {
@@ -38745,57 +38820,379 @@ var init_pairing = __esm(() => {
   BASE64URL_32_BYTES = /^[A-Za-z0-9_-]{43}$/;
 });
 
-// packages/gateway/src/mobile/listener.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { createServer as createServer2 } from "https";
-import { hostname, networkInterfaces } from "os";
-import { createHost as createHost2, memoryLinkPair } from "@earendil-works/chord";
-import { WebSocketServer as WebSocketServer2 } from "ws";
-function defaultServerName() {
-  const name = hostname().trim();
-  return (name === "" ? "neko-computer" : name).slice(0, 64);
+// packages/gateway/src/mobile/relay.ts
+import { spawn as nodeSpawn } from "child_process";
+function assertPort2(port, label) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new Error(`relay ${label} port is invalid`);
 }
-function isVirtualInterfaceName(name) {
-  const lower = name.toLowerCase();
-  if (VIRTUAL_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix)))
-    return true;
-  return VIRTUAL_INTERFACE_KEYWORDS.some((keyword) => lower.includes(keyword));
+function buildRelayScript(endpoints, watchdogMs = RELAY_WATCHDOG_MS) {
+  if (!isIpv4Literal(endpoints.listenAddress) || !isIpv4Literal(endpoints.targetAddress)) {
+    throw new Error("relay addresses must be IPv4 literals");
+  }
+  assertPort2(endpoints.listenPort, "listen");
+  assertPort2(endpoints.targetPort, "target");
+  if (!Number.isInteger(watchdogMs) || watchdogMs < 1000)
+    throw new Error("relay watchdog is invalid");
+  return [
+    "$ErrorActionPreference='Stop'",
+    `$src=@'
+${RELAY_SOURCE}
+'@`,
+    "Add-Type -TypeDefinition $src -Language CSharp",
+    `[NekoRelay]::Run('${endpoints.listenAddress}',${endpoints.listenPort},'${endpoints.targetAddress}',${endpoints.targetPort},${watchdogMs})`
+  ].join(`
+`);
 }
-function isBenchmarkAddress(address) {
-  return address.startsWith("198.18.") || address.startsWith("198.19.");
+function encodeRelayCommand(script) {
+  return Buffer.from(script, "utf16le").toString("base64");
 }
-function collectListenCandidates(interfaces, skipVirtual) {
-  const candidates = [];
-  for (const [name, infos] of Object.entries(interfaces)) {
-    if (infos === undefined)
-      continue;
-    if (skipVirtual && isVirtualInterfaceName(name))
+function describeExit(child) {
+  return child.signalCode !== null ? `signal ${child.signalCode}` : `exit code ${child.exitCode}`;
+}
+async function startWindowsRelay(options) {
+  const watchdogMs = options.watchdogMs ?? RELAY_WATCHDOG_MS;
+  const script = buildRelayScript(options, watchdogMs);
+  const spawn = options.spawn ?? nodeSpawn;
+  const child = spawn(options.powershell, ["-NoProfile", "-NonInteractive", "-EncodedCommand", encodeRelayCommand(script)], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+  let stderrTail = "";
+  child.stderr?.on("data", (chunk) => {
+    stderrTail = (stderrTail + chunk.toString("utf8")).slice(-STDERR_TAIL_BYTES);
+  });
+  child.stdin?.on("error", () => {});
+  const exited = new Promise((resolve) => {
+    child.once("error", (error) => resolve(`spawn error: ${error.message}`));
+    child.once("exit", () => resolve(describeExit(child)));
+  });
+  let heartbeat;
+  let stopping;
+  const stop = () => {
+    stopping ??= (async () => {
+      clearInterval(heartbeat);
+      child.stdin?.end();
+      const grace = options.stopGraceMs ?? STOP_GRACE_MS;
+      const done = await Promise.race([exited.then(() => true), delay2(grace).then(() => false)]);
+      if (!done) {
+        child.kill("SIGKILL");
+        await Promise.race([exited, delay2(grace)]);
+      }
+    })();
+    return stopping;
+  };
+  const ready = new Promise((resolve, reject) => {
+    let buffer = "";
+    const timer = setTimeout(() => reject(new RelayError("timeout", "Windows relay did not become ready in time")), options.startTimeoutMs ?? START_TIMEOUT_MS);
+    const finish = (action) => {
+      clearTimeout(timer);
+      action();
+    };
+    child.stdout?.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      for (;; ) {
+        const newline = buffer.indexOf(`
+`);
+        if (newline < 0)
+          break;
+        const line = buffer.slice(0, newline).trim();
+        buffer = buffer.slice(newline + 1);
+        if (line === "READY")
+          finish(resolve);
+        else if (line.startsWith("ERROR ")) {
+          const [, code = "start_failed", ...rest] = line.split(" ");
+          const known = ["port_in_use", "listen_failed", "target_unreachable"];
+          const mapped = known.find((item) => item === code) ?? "start_failed";
+          finish(() => reject(new RelayError(mapped, rest.join(" ") || code)));
+        }
+      }
+    });
+    exited.then((reason) => {
+      const detail = stderrTail.trim();
+      finish(() => reject(new RelayError("start_failed", `Windows relay exited before it was ready (${reason})${detail === "" ? "" : `: ${detail}`}`)));
+    });
+  });
+  try {
+    await ready;
+  } catch (error) {
+    await stop();
+    throw error;
+  }
+  heartbeat = setInterval(() => {
+    child.stdin?.write(`
+`);
+  }, options.heartbeatMs ?? RELAY_HEARTBEAT_INTERVAL_MS);
+  heartbeat.unref?.();
+  return { exited, stop };
+}
+function delay2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var RelayError, RELAY_HEARTBEAT_INTERVAL_MS = 2000, RELAY_WATCHDOG_MS = 8000, START_TIMEOUT_MS = 20000, STOP_GRACE_MS = 1000, STDERR_TAIL_BYTES = 2000, RELAY_SOURCE = `using System;
+using System.Diagnostics;
+using System.Net;
+using System.Net.Sockets;
+using System.Threading;
+
+public static class NekoRelay
+{
+    static readonly Stopwatch Clock = Stopwatch.StartNew();
+    static long lastBeatMs = 0;
+
+    static void Touch() { Interlocked.Exchange(ref lastBeatMs, Clock.ElapsedMilliseconds); }
+    static string Flat(string text) { return text.Replace("\\r", " ").Replace("\\n", " "); }
+    static void Close(TcpClient client) { if (client != null) { try { client.Close(); } catch (Exception) { } } }
+
+    static void Copy(TcpClient from, TcpClient to)
+    {
+        byte[] buffer = new byte[16384];
+        try
+        {
+            System.IO.Stream source = from.GetStream();
+            System.IO.Stream sink = to.GetStream();
+            int count;
+            while ((count = source.Read(buffer, 0, buffer.Length)) > 0) { sink.Write(buffer, 0, count); }
+        }
+        catch (Exception) { }
+        try { to.Client.Shutdown(SocketShutdown.Send); } catch (Exception) { }
+    }
+
+    static void Pump(object state)
+    {
+        object[] args = (object[])state;
+        TcpClient client = (TcpClient)args[0];
+        TcpClient target = null;
+        try
+        {
+            target = new TcpClient();
+            target.NoDelay = true;
+            client.NoDelay = true;
+            target.Connect((string)args[1], (int)args[2]);
+            Thread upstream = new Thread(delegate() { Copy(client, target); });
+            upstream.IsBackground = true;
+            upstream.Start();
+            Copy(target, client);
+        }
+        catch (Exception) { }
+        finally { Close(client); Close(target); }
+    }
+
+    public static void Run(string listenIp, int listenPort, string targetIp, int targetPort, int watchdogMs)
+    {
+        TcpListener listener = new TcpListener(IPAddress.Parse(listenIp), listenPort);
+        listener.ExclusiveAddressUse = true;
+        try { listener.Start(128); }
+        catch (SocketException e)
+        {
+            string code = (e.SocketErrorCode == SocketError.AddressAlreadyInUse || e.SocketErrorCode == SocketError.AccessDenied) ? "port_in_use" : "listen_failed";
+            Console.Out.WriteLine("ERROR " + code + " " + Flat(e.Message));
+            Console.Out.Flush();
+            Environment.Exit(2);
+        }
+        try
+        {
+            TcpClient probe = new TcpClient();
+            IAsyncResult pending = probe.BeginConnect(targetIp, targetPort, null, null);
+            if (!pending.AsyncWaitHandle.WaitOne(3000)) { throw new TimeoutException("connect timed out"); }
+            probe.EndConnect(pending);
+            probe.Close();
+        }
+        catch (Exception e)
+        {
+            Console.Out.WriteLine("ERROR target_unreachable " + Flat(e.Message));
+            Console.Out.Flush();
+            Environment.Exit(3);
+        }
+        Touch();
+        Thread input = new Thread(delegate()
+        {
+            try { while (Console.In.ReadLine() != null) { Touch(); } } catch (Exception) { }
+            Environment.Exit(0);
+        });
+        input.IsBackground = true;
+        input.Start();
+        Thread watchdog = new Thread(delegate()
+        {
+            while (true)
+            {
+                Thread.Sleep(1000);
+                if (Clock.ElapsedMilliseconds - Interlocked.Read(ref lastBeatMs) > watchdogMs) { Environment.Exit(0); }
+            }
+        });
+        watchdog.IsBackground = true;
+        watchdog.Start();
+        Console.Out.WriteLine("READY");
+        Console.Out.Flush();
+        while (true)
+        {
+            TcpClient accepted;
+            try { accepted = listener.AcceptTcpClient(); }
+            catch (Exception) { Environment.Exit(4); return; }
+            ThreadPool.QueueUserWorkItem(Pump, new object[] { accepted, targetIp, targetPort });
+        }
+    }
+}`;
+var init_relay = __esm(() => {
+  init_network();
+  RelayError = class RelayError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.name = "RelayError";
+      this.code = code;
+    }
+  };
+});
+
+// packages/gateway/src/mobile/wsl.ts
+import { execFile as execFile2 } from "child_process";
+import { accessSync as accessSync2, constants as constants2, readFileSync as readFileSync2 } from "fs";
+import { networkInterfaces as networkInterfaces2 } from "os";
+import { delimiter, join as join10 } from "path";
+function detectWsl(overrides = {}) {
+  const deps = { ...defaultProbeDeps, ...overrides };
+  if (deps.platform !== "linux")
+    return;
+  const { env } = deps;
+  const version = deps.readProcVersion() ?? "";
+  const inWsl = (env.WSL_DISTRO_NAME ?? "") !== "" || (env.WSL_INTEROP ?? "") !== "" || /microsoft|wsl/i.test(version);
+  if (!inWsl)
+    return;
+  const candidates = [
+    ...(env.PATH ?? "").split(delimiter).filter((dir) => dir !== "").map((dir) => join10(dir, "powershell.exe")),
+    POWERSHELL_FALLBACK
+  ];
+  return { powershell: candidates.find((candidate) => deps.isExecutable(candidate)) };
+}
+function parseWindowsInterfaces(output) {
+  const text = output.replace(/^\uFEFF/, "").trim();
+  if (text === "")
+    return [];
+  const parsed = JSON.parse(text);
+  const items = Array.isArray(parsed) ? parsed : [parsed];
+  const result = [];
+  for (const item of items) {
+    if (typeof item !== "object" || item === null)
       continue;
-    for (const info of infos) {
-      if (info.family !== "IPv4" || info.internal)
-        continue;
-      if (info.address.startsWith("169.254."))
-        continue;
-      if (skipVirtual && isBenchmarkAddress(info.address))
-        continue;
-      candidates.push(info.address);
+    const { name, address } = item;
+    if (typeof name === "string" && typeof address === "string" && isIpv4Literal(address)) {
+      result.push({ name, address });
     }
   }
-  return candidates.sort();
+  return result;
 }
-function mobileListenCandidates(interfaces) {
-  const source = interfaces ?? networkInterfaces();
-  const filtered = collectListenCandidates(source, true);
-  return filtered.length > 0 ? filtered : collectListenCandidates(source, false);
+function toInterfaceDict(interfaces) {
+  const dict = {};
+  for (const { name, address } of interfaces) {
+    const list = dict[name] ?? [];
+    dict[name] = list;
+    list.push({
+      address,
+      netmask: "255.255.255.0",
+      family: "IPv4",
+      mac: "00:00:00:00:00:00",
+      internal: false,
+      cidr: `${address}/24`
+    });
+  }
+  return dict;
 }
-function prioritizeListenCandidate(candidates, lastConnectedAddress) {
-  if (lastConnectedAddress === null || !candidates.includes(lastConnectedAddress))
-    return [...candidates];
-  return [lastConnectedAddress, ...candidates.filter((candidate) => candidate !== lastConnectedAddress)];
+
+class WindowsAddressDiscovery {
+  powershell;
+  run;
+  cacheMs;
+  timeoutMs;
+  now;
+  cached;
+  pending;
+  constructor(options) {
+    this.powershell = options.powershell;
+    this.run = options.run ?? runPowerShell;
+    this.cacheMs = options.cacheMs ?? 15000;
+    this.timeoutMs = options.timeoutMs ?? 1e4;
+    this.now = options.now ?? Date.now;
+  }
+  invalidate() {
+    this.cached = undefined;
+  }
+  candidates() {
+    if (this.cached !== undefined && this.now() - this.cached.at < this.cacheMs) {
+      return Promise.resolve([...this.cached.addresses]);
+    }
+    this.pending ??= this.read().finally(() => {
+      this.pending = undefined;
+    });
+    return this.pending.then((addresses) => [...addresses]);
+  }
+  async read() {
+    const output = await this.run(this.powershell, WINDOWS_ADDRESSES_SCRIPT, this.timeoutMs);
+    const usable = parseWindowsInterfaces(output).filter((item) => !WSL_ADAPTER_PATTERN.test(item.name));
+    const addresses = mobileListenCandidates(toInterfaceDict(usable));
+    this.cached = { at: this.now(), addresses };
+    return addresses;
+  }
 }
-function isIpv4Literal(address) {
-  const parts = address.split(".");
-  return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+function wslOwnAddresses(interfaces = networkInterfaces2()) {
+  const result = [];
+  for (const infos of Object.values(interfaces)) {
+    for (const info of infos ?? []) {
+      if (info.family === "IPv4" && !info.internal)
+        result.push(info.address);
+    }
+  }
+  return result;
+}
+function primaryWslAddress(interfaces = networkInterfaces2()) {
+  const eth0 = (interfaces.eth0 ?? []).find((info) => info.family === "IPv4" && !info.internal);
+  return eth0?.address ?? wslOwnAddresses(interfaces)[0];
+}
+var POWERSHELL_FALLBACK = "/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe", defaultProbeDeps, WINDOWS_ADDRESSES_SCRIPT, WSL_ADAPTER_PATTERN, runPowerShell = (powershell, script, timeoutMs) => new Promise((resolve, reject) => {
+  execFile2(powershell, ["-NoProfile", "-NonInteractive", "-Command", script], { timeout: timeoutMs, windowsHide: true, maxBuffer: 1024 * 1024, encoding: "utf8" }, (error, stdout) => error ? reject(error) : resolve(stdout));
+});
+var init_wsl = __esm(() => {
+  init_network();
+  defaultProbeDeps = {
+    platform: process.platform,
+    env: process.env,
+    readProcVersion() {
+      try {
+        return readFileSync2("/proc/version", "utf8");
+      } catch {
+        return;
+      }
+    },
+    isExecutable(path) {
+      try {
+        accessSync2(path, constants2.X_OK);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+  WINDOWS_ADDRESSES_SCRIPT = [
+    "$ErrorActionPreference='Stop'",
+    "$r=@()",
+    "foreach($n in [System.Net.NetworkInformation.NetworkInterface]::GetAllNetworkInterfaces()){",
+    "if($n.OperationalStatus -ne 'Up'){continue}",
+    "if($n.NetworkInterfaceType -eq 'Loopback' -or $n.NetworkInterfaceType -eq 'Tunnel'){continue}",
+    "foreach($a in $n.GetIPProperties().UnicastAddresses){",
+    "if($a.Address.AddressFamily -eq 'InterNetwork'){$r+=[pscustomobject]@{name=$n.Name;address=$a.Address.IPAddressToString}}",
+    "}}",
+    "ConvertTo-Json -InputObject @($r) -Compress"
+  ].join(`
+`);
+  WSL_ADAPTER_PATTERN = /wsl|hyper-v|vethernet/i;
+});
+
+// packages/gateway/src/mobile/listener.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { createServer as createServer2 } from "https";
+import { hostname } from "os";
+import { createHost as createHost2, memoryLinkPair } from "@earendil-works/chord";
+import { WebSocketServer as WebSocketServer2 } from "ws";
+function defaultServerName() {
+  const name = hostname().trim();
+  return (name === "" ? "neko-computer" : name).slice(0, 64);
 }
 function assertListenAddress(address) {
   if (!isIpv4Literal(address))
@@ -38807,6 +39204,22 @@ function assertListenAddress(address) {
 function toError(error) {
   return error instanceof Error ? error : new Error(String(error));
 }
+function describeRelayError(error, address, port, bindAddress) {
+  if (!(error instanceof RelayError))
+    return `Windows \u4E2D\u7EE7\u542F\u52A8\u5931\u8D25\uFF1A${toMessage(error)}`;
+  switch (error.code) {
+    case "port_in_use":
+      return `Windows \u4E0A ${address}:${port} \u5DF2\u88AB\u5360\u7528\uFF0C\u8BF7\u66F4\u6362\u7AEF\u53E3\u6216\u91CA\u653E\u8BE5\u7AEF\u53E3\u540E\u91CD\u8BD5\u3002`;
+    case "target_unreachable":
+      return `Windows \u65E0\u6CD5\u8FDE\u63A5\u5230 WSL \u5185\u7684\u76D1\u542C\u5730\u5740 ${bindAddress}:${port}\uFF08${error.message}\uFF09\u3002`;
+    case "timeout":
+      return "Windows \u4E2D\u7EE7\u542F\u52A8\u8D85\u65F6\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002";
+    case "listen_failed":
+      return `Windows \u4E2D\u7EE7\u65E0\u6CD5\u5728 ${address}:${port} \u4E0A\u76D1\u542C\uFF1A${error.message}`;
+    default:
+      return `Windows \u4E2D\u7EE7\u542F\u52A8\u5931\u8D25\uFF1A${error.message}`;
+  }
+}
 function isMobilePrincipal2(principal) {
   return typeof principal === "object" && principal !== null && principal.kind === "mobile";
 }
@@ -38836,7 +39249,26 @@ class MobileGateway {
   stateValue;
   queue = Promise.resolve();
   closing;
-  constructor(serverId, serverName, onError, chord, store, storeFailure, initial) {
+  relay;
+  wslEnvironment;
+  windowsAddresses;
+  startRelay;
+  localInterfaces;
+  relayPortRetryMs;
+  relayPortRetryIntervalMs;
+  constructor(serverId, serverName, onError, chord, store, storeFailure, initial, network = {}) {
+    this.wslEnvironment = network.wsl === null ? undefined : network.wsl ?? detectWsl();
+    const powershell = this.wslEnvironment?.powershell;
+    if (network.windowsCandidates !== undefined)
+      this.windowsAddresses = network.windowsCandidates;
+    else if (powershell !== undefined) {
+      const discovery = new WindowsAddressDiscovery({ powershell });
+      this.windowsAddresses = () => discovery.candidates();
+    }
+    this.startRelay = network.startRelay ?? startWindowsRelay;
+    this.localInterfaces = network.localInterfaces;
+    this.relayPortRetryMs = network.relayPortRetryMs ?? RELAY_PORT_RETRY_MS;
+    this.relayPortRetryIntervalMs = network.relayPortRetryIntervalMs ?? RELAY_PORT_RETRY_INTERVAL_MS;
     this.serverId = serverId;
     this.serverName = serverName;
     this.onError = onError;
@@ -38853,7 +39285,7 @@ class MobileGateway {
     } catch (error) {
       storeFailure = toMessage(error);
     }
-    const gateway = new MobileGateway(options.serverId, options.serverName ?? defaultServerName(), options.onError, options.chord, store, storeFailure, storeFailure === undefined ? { status: "disabled" } : { status: "error", error: `mobile store unavailable: ${storeFailure}` });
+    const gateway = new MobileGateway(options.serverId, options.serverName ?? defaultServerName(), options.onError, options.chord, store, storeFailure, storeFailure === undefined ? { status: "disabled" } : { status: "error", error: `mobile store unavailable: ${storeFailure}` }, options.network);
     gateway.runtime = options.runtime;
     if (store !== undefined) {
       const config = store.getState();
@@ -38925,12 +39357,30 @@ class MobileGateway {
     }
     return false;
   }
-  adminState() {
+  async adminState() {
     const store = this.requireStore();
     const config = store.getState();
+    let candidates;
+    let wsl = null;
+    if (this.wslEnvironment === undefined) {
+      candidates = mobileListenCandidates();
+    } else {
+      candidates = [];
+      let error = null;
+      if (this.windowsAddresses === undefined)
+        error = WSL_INTEROP_UNAVAILABLE;
+      else {
+        try {
+          candidates = await this.windowsAddresses();
+        } catch (caught) {
+          error = `\u8BFB\u53D6 Windows \u5C40\u57DF\u7F51\u5730\u5740\u5931\u8D25\uFF1A${toMessage(caught)}`;
+        }
+      }
+      wsl = { interop: this.windowsAddresses !== undefined, error };
+    }
     return {
       state: this.stateValue,
-      candidates: prioritizeListenCandidate(mobileListenCandidates(), config.lastConnectedAddress),
+      candidates: prioritizeListenCandidate(candidates, config.lastConnectedAddress),
       port: config.port,
       certificate: this.certificate === undefined ? null : { fingerprint: this.certificate.fingerprint, expiresAt: this.certificate.expiresAt },
       devices: config.devices.map((device) => ({
@@ -38940,7 +39390,8 @@ class MobileGateway {
         lastSeenAt: device.lastSeenAt,
         online: this.deviceOnline(device.deviceId)
       })),
-      lastConnectedAddress: config.lastConnectedAddress
+      lastConnectedAddress: config.lastConnectedAddress,
+      wsl
     };
   }
   async regenerateCertificate() {
@@ -39020,9 +39471,10 @@ class MobileGateway {
     if (store?.getState().devices.some((device) => device.deviceId === auth.deviceId)) {
       store.touchDevice(auth.deviceId, Date.now()).catch((error) => this.onError?.(toError(error)));
     }
-    if (store !== undefined && typeof localAddress === "string" && isIpv4Literal(localAddress)) {
-      if (store.getState().lastConnectedAddress !== localAddress) {
-        store.rememberConnectedAddress(localAddress).catch((error) => this.onError?.(toError(error)));
+    const learned = this.advertisedAddress(localAddress);
+    if (store !== undefined && typeof learned === "string" && isIpv4Literal(learned)) {
+      if (store.getState().lastConnectedAddress !== learned) {
+        store.rememberConnectedAddress(learned).catch((error) => this.onError?.(toError(error)));
       }
     }
     const clientHost = createHost2({
@@ -39106,6 +39558,13 @@ class MobileGateway {
     for (const connection of this.connections.values())
       connection.sendNotification(method, params);
   }
+  advertisedAddress(localAddress) {
+    const state = this.stateValue;
+    if (state.status === "listening" && state.mode === "wsl-relay" && localAddress === state.bindAddress) {
+      return state.address;
+    }
+    return localAddress;
+  }
   requireStore() {
     if (this.storeHandle === undefined)
       throw new Error(`mobile store is unavailable: ${this.storeFailure ?? "unknown error"}`);
@@ -39118,6 +39577,7 @@ class MobileGateway {
     await this.stopListening();
     this.stateValue = { status: "starting" };
     try {
+      const plan = await this.planListen(address);
       const certificate = await this.certificateValue();
       const server = createServer2({ cert: certificate.certPem, key: certificate.keyPem }, (request, response) => {
         this.handleRequest(request, response);
@@ -39145,11 +39605,10 @@ class MobileGateway {
         };
         server.once("error", onFailure);
         server.once("listening", onListening);
-        server.listen(port, address);
+        server.listen(port, plan.bindAddress);
       });
       this.server = server;
       this.wss = wss;
-      this.stateValue = { status: "listening", address, port };
       server.on("error", (error) => {
         this.stateValue = { status: "error", error: toMessage(error) };
         this.onError?.(error);
@@ -39157,6 +39616,9 @@ class MobileGateway {
           return;
         });
       });
+      if (plan.mode === "wsl-relay")
+        await this.startRelayFor(address, port, plan.bindAddress);
+      this.stateValue = plan.mode === "wsl-relay" ? { status: "listening", address, port, mode: "wsl-relay", bindAddress: plan.bindAddress } : { status: "listening", address, port };
     } catch (error) {
       await this.stopListening().catch(() => {
         return;
@@ -39165,6 +39627,66 @@ class MobileGateway {
       throw error;
     }
   }
+  async planListen(address) {
+    if (this.wslEnvironment === undefined)
+      return { mode: "direct", bindAddress: address };
+    if (this.windowsAddresses === undefined)
+      throw new Error(WSL_INTEROP_UNAVAILABLE);
+    let candidates;
+    try {
+      candidates = await this.windowsAddresses();
+    } catch (error) {
+      throw new Error(`\u8BFB\u53D6 Windows \u5C40\u57DF\u7F51\u5730\u5740\u5931\u8D25\uFF1A${toMessage(error)}`);
+    }
+    if (!candidates.includes(address)) {
+      throw new Error(`${address} \u4E0D\u662F\u5F53\u524D\u53EF\u7528\u7684 Windows \u5C40\u57DF\u7F51\u5730\u5740\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9\u540E\u518D\u5F00\u542F\u3002`);
+    }
+    const interfaces = this.localInterfaces?.();
+    if (wslOwnAddresses(interfaces).includes(address))
+      return { mode: "direct", bindAddress: address };
+    const bindAddress = primaryWslAddress(interfaces);
+    if (bindAddress === undefined)
+      throw new Error("WSL \u5185\u6CA1\u6709\u53EF\u7528\u7684\u7F51\u7EDC\u5730\u5740\uFF0C\u65E0\u6CD5\u5EFA\u7ACB\u624B\u673A\u5165\u53E3\u3002");
+    return { mode: "wsl-relay", bindAddress };
+  }
+  async startRelayFor(address, port, bindAddress) {
+    const deadline = Date.now() + this.relayPortRetryMs;
+    let relay;
+    for (;; ) {
+      try {
+        relay = await this.startRelay({
+          powershell: this.wslEnvironment?.powershell ?? "powershell.exe",
+          listenAddress: address,
+          listenPort: port,
+          targetAddress: bindAddress,
+          targetPort: port
+        });
+        break;
+      } catch (error) {
+        if (error instanceof RelayError && error.code === "port_in_use" && Date.now() + this.relayPortRetryIntervalMs < deadline) {
+          await new Promise((resolve) => setTimeout(resolve, this.relayPortRetryIntervalMs));
+          continue;
+        }
+        throw new Error(describeRelayError(error, address, port, bindAddress));
+      }
+    }
+    this.relay = relay;
+    relay.exited.then((reason) => this.onRelayExited(relay, reason));
+  }
+  onRelayExited(relay, reason) {
+    this.enqueue(async () => {
+      if (this.relay !== relay)
+        return;
+      this.relay = undefined;
+      this.pairingValue?.invalidate();
+      await this.stopListening().catch(() => {
+        return;
+      });
+      const message = `Windows \u4E2D\u7EE7\u610F\u5916\u9000\u51FA\uFF08${reason}\uFF09\uFF0C\u8BF7\u91CD\u65B0\u5F00\u542F\u624B\u673A\u8BBF\u95EE\u3002`;
+      this.stateValue = { status: "error", error: message };
+      this.onError?.(new Error(message));
+    });
+  }
   async certificateValue() {
     if (this.certificate === undefined) {
       this.certificate = await MobileCertificate.load(this.requireStore(), this.serverId);
@@ -39172,6 +39694,12 @@ class MobileGateway {
     return this.certificate;
   }
   async stopListening() {
+    const relay = this.relay;
+    this.relay = undefined;
+    if (relay !== undefined)
+      await relay.stop().catch(() => {
+        return;
+      });
     for (const connection of [...this.connections.values()])
       connection.close(1001, "listener_stopped");
     const server = this.server;
@@ -39276,42 +39804,26 @@ ${JSON.stringify({ code, message })}`);
     return run;
   }
 }
-var VIRTUAL_INTERFACE_PREFIXES, VIRTUAL_INTERFACE_KEYWORDS;
+var RELAY_PORT_RETRY_MS = 1e4, RELAY_PORT_RETRY_INTERVAL_MS = 1000, WSL_INTEROP_UNAVAILABLE = "WSL \u7684 Windows \u4E92\u64CD\u4F5C\u4E0D\u53EF\u7528\uFF08\u627E\u4E0D\u5230 powershell.exe\uFF09\uFF0C\u65E0\u6CD5\u8BFB\u53D6 Windows \u5C40\u57DF\u7F51\u5730\u5740\u3002\u8BF7\u542F\u7528 WSL \u4E92\u64CD\u4F5C\uFF0C\u6216\u76F4\u63A5\u5728 Windows \u4E0A\u8FD0\u884C neko\u3002";
 var init_listener = __esm(() => {
   init_contract();
   init_link();
   init_adapter();
   init_auth();
   init_certificate();
+  init_network();
   init_pairing();
   init_protocol();
+  init_relay();
   init_store();
-  VIRTUAL_INTERFACE_PREFIXES = [
-    "anpi",
-    "awdl",
-    "bridge",
-    "docker",
-    "gif",
-    "ipsec",
-    "llw",
-    "ppp",
-    "stf",
-    "tap",
-    "tun",
-    "utun",
-    "vboxnet",
-    "veth",
-    "virbr",
-    "vmnet"
-  ];
-  VIRTUAL_INTERFACE_KEYWORDS = ["hyper-v", "virtual", "virtualbox", "vmware", "vpn"];
+  init_wsl();
 });
 
 // packages/gateway/src/port-file.ts
 import { readFile as readFile7, rm as rm4, writeFile as writeFile4 } from "fs/promises";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function gatewayPortFilePath(nekoDir, serverId) {
-  return join10(nekoDir, `${serverId}.port`);
+  return join11(nekoDir, `${serverId}.port`);
 }
 async function writeGatewayPortFile(nekoDir, serverId, wsUrl) {
   await writeFile4(gatewayPortFilePath(nekoDir, serverId), `${wsUrl}
@@ -40428,7 +40940,7 @@ var init_esm = __esm(() => {
 import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
 import { mkdir as mkdir6, readdir as readdir2, rename as rename4, rm as rm5, stat as stat3, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir7 } from "os";
-import { dirname as dirname8, join as join11 } from "path";
+import { dirname as dirname8, join as join12 } from "path";
 function createSkillMarketClient(options) {
   const home = options.home ?? homedir7();
   const fetchImpl = options.fetchImpl ?? fetch;
@@ -40545,11 +41057,11 @@ function createSkillMarketClient(options) {
     } catch {
       return;
     }
-    await Promise.all(names.filter((n) => n.startsWith(".tmp-")).map((n) => rm5(join11(parent, n), { recursive: true, force: true }).catch(() => {})));
+    await Promise.all(names.filter((n) => n.startsWith(".tmp-")).map((n) => rm5(join12(parent, n), { recursive: true, force: true }).catch(() => {})));
   };
   const install = async ({ name, scope, workspaceRoot, overwrite }) => {
     const skillsDir = skillsDirFor(scope, workspaceRoot);
-    const target = join11(skillsDir, name);
+    const target = join12(skillsDir, name);
     const exists = await stat3(target).catch(() => {
       return;
     }) !== undefined;
@@ -40558,10 +41070,10 @@ function createSkillMarketClient(options) {
     const skill = await detail(name);
     const files = unpack(skill, await download(skill));
     await sweepTempDirs(skillsDir);
-    const temp = join11(dirname8(skillsDir), `.tmp-${randomUUID3()}`);
+    const temp = join12(dirname8(skillsDir), `.tmp-${randomUUID3()}`);
     try {
       for (const [relative, bytes] of files) {
-        const dest = join11(temp, ...relative.split("/"));
+        const dest = join12(temp, ...relative.split("/"));
         await mkdir6(dirname8(dest), { recursive: true });
         await writeFile5(dest, bytes);
       }
@@ -40574,7 +41086,7 @@ function createSkillMarketClient(options) {
     }
     let shadowedBy;
     if (scope === "user" && workspaceRoot !== undefined && workspaceRoot !== "") {
-      const projectDir = join11(projectSkillsDir(workspaceRoot), name);
+      const projectDir = join12(projectSkillsDir(workspaceRoot), name);
       if (await stat3(projectDir).catch(() => {
         return;
       }) !== undefined)
@@ -40584,7 +41096,7 @@ function createSkillMarketClient(options) {
   };
   const uninstall = async ({ name, scope, workspaceRoot }) => {
     const skillsDir = skillsDirFor(scope, workspaceRoot);
-    const target = join11(skillsDir, name);
+    const target = join12(skillsDir, name);
     if (await stat3(target).catch(() => {
       return;
     }) === undefined)
@@ -40616,7 +41128,7 @@ function createSkillMarketClient(options) {
     uninstall
   };
 }
-var SkillMarketError, CATALOG_TTL_MS = 60000, ZIP_CACHE_MAX = 16, MAX_PACKAGE_BYTES, userSkillsDir2 = (home) => join11(home, ".agents", "skills"), projectSkillsDir = (workspaceRoot) => join11(workspaceRoot, ".agents", "skills"), activeLevelOf = (state) => state.project ? "project" : state.user ? "user" : state.builtin ? "builtin" : null, normalizeEntry = (raw) => {
+var SkillMarketError, CATALOG_TTL_MS = 60000, ZIP_CACHE_MAX = 16, MAX_PACKAGE_BYTES, userSkillsDir2 = (home) => join12(home, ".agents", "skills"), projectSkillsDir = (workspaceRoot) => join12(workspaceRoot, ".agents", "skills"), activeLevelOf = (state) => state.project ? "project" : state.user ? "user" : state.builtin ? "builtin" : null, normalizeEntry = (raw) => {
   const row = raw ?? {};
   const metadata = row.metadata;
   const source = metadata !== null && typeof metadata === "object" ? metadata.source : undefined;
@@ -40647,9 +41159,9 @@ var init_skill_market = __esm(() => {
 });
 
 // packages/gateway/src/workspaces.ts
-import { constants as constants2 } from "fs";
+import { constants as constants3 } from "fs";
 import { access, readdir as readdir3, stat as stat4 } from "fs/promises";
-import { dirname as dirname9, isAbsolute as isAbsolute3, join as join12 } from "path";
+import { dirname as dirname9, isAbsolute as isAbsolute3, join as join13 } from "path";
 async function browseWorkspaces(options) {
   const requested = options.path.replace(/^\/+([A-Za-z]:[\\/])/, "$1");
   if (process.platform === "win32" && (requested === "/" || requested === "\\")) {
@@ -40676,13 +41188,13 @@ async function browseWorkspaces(options) {
   let next = offset;
   for (;next < entries.length && directories.length < 100; next++) {
     const entry = entries[next];
-    const target = join12(path, entry.name);
+    const target = join13(path, entry.name);
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
     try {
       if (!(await stat4(target)).isDirectory())
         continue;
-      await access(target, constants2.R_OK | constants2.X_OK);
+      await access(target, constants3.R_OK | constants3.X_OK);
       directories.push({ name: entry.name, path: target });
     } catch {
       directories.push({ name: entry.name, path: target, error: "\u76EE\u5F55\u4E0D\u53EF\u8BBF\u95EE" });
@@ -40961,7 +41473,7 @@ var init_server_services = __esm(() => {
 // packages/gateway/src/gateway.ts
 import { randomUUID as randomUUID5 } from "crypto";
 import { mkdir as mkdir7, readFile as readFile8, writeFile as writeFile6 } from "fs/promises";
-import { basename as basename6, dirname as dirname10, join as join13 } from "path";
+import { basename as basename6, dirname as dirname10, join as join14 } from "path";
 import { createHost as createHost3 } from "@earendil-works/chord";
 import { BACKGROUND_CONTEXT as BACKGROUND_CONTEXT4 } from "@earendil-works/chord/context";
 async function startGateway(options = {}) {
@@ -40974,7 +41486,7 @@ async function startGateway(options = {}) {
   const marketUrl = options.marketUrl ?? fileConfig.skills?.marketUrl ?? DEFAULT_SKILL_MARKET_URL;
   const nekoDir = dirname10(storagePath);
   const serverId = options.serverId ?? await loadOrCreateServerId(nekoDir);
-  const socketPath = options.socketPath !== undefined ? options.socketPath : fileConfig.gateway?.socketPath !== undefined ? fileConfig.gateway.socketPath : process.platform === "win32" ? null : join13(nekoDir, `${serverId}.sock`);
+  const socketPath = options.socketPath !== undefined ? options.socketPath : fileConfig.gateway?.socketPath !== undefined ? fileConfig.gateway.socketPath : process.platform === "win32" ? null : join14(nekoDir, `${serverId}.sock`);
   const runtime = await createNekoRuntime({
     context,
     onReport: (error) => options.onError?.(error instanceof Error ? error : new Error(String(error))),
@@ -41134,7 +41646,7 @@ function serverIdFromSocketPath(socketPath) {
   return isServerId(candidate) ? candidate : undefined;
 }
 async function loadOrCreateServerId(nekoDir) {
-  const file = join13(nekoDir, SERVER_ID_FILENAME);
+  const file = join14(nekoDir, SERVER_ID_FILENAME);
   try {
     const existing = (await readFile8(file, "utf8")).trim();
     if (existing !== "")
@@ -41170,20 +41682,89 @@ function gatewayCommand(args) {
     ]
   };
 }
-async function stopGatewayProcess(child) {
+async function stopGatewayProcess(child, options = {}) {
   if (child.pid === undefined || child.exitCode !== null || child.signalCode !== null)
     return;
   await new Promise((resolve) => {
-    const timer = setTimeout(() => child.kill("SIGKILL"), 3000);
+    let forcedTimer;
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      forcedTimer = setTimeout(resolve, options.forcedMs ?? FORCED_STOP_MS);
+    }, options.gracefulMs ?? GRACEFUL_STOP_MS);
     child.once("exit", () => {
       clearTimeout(timer);
+      clearTimeout(forcedTimer);
       resolve();
     });
     child.kill("SIGTERM");
   });
 }
+var GRACEFUL_STOP_MS = 3000, FORCED_STOP_MS = 2000;
 var init_process = () => {};
 
+// packages/gateway/src/shutdown.ts
+function shutdownSignals(platform) {
+  const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+  if (platform === "win32")
+    signals.push("SIGBREAK");
+  return signals;
+}
+function installShutdown(options = {}) {
+  const proc = options.process ?? process;
+  const exit = options.exit ?? ((code) => process.exit(code));
+  const timeoutMs = options.timeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
+  const controller = new AbortController;
+  let cleanup;
+  let cleaning = false;
+  let timer;
+  const runCleanup = () => {
+    if (cleaning || cleanup === undefined)
+      return;
+    cleaning = true;
+    cleanup().then(() => exit(0), (error) => {
+      options.log?.(error instanceof Error ? error.message : String(error));
+      exit(1);
+    });
+  };
+  const onSignal = () => {
+    if (controller.signal.aborted) {
+      options.log?.("\u518D\u6B21\u6536\u5230\u7EC8\u6B62\u4FE1\u53F7\uFF0C\u5F3A\u5236\u9000\u51FA\u3002");
+      exit(130);
+      return;
+    }
+    options.log?.(`
+\u6B63\u5728\u5173\u95ED\u2026`);
+    controller.abort();
+    timer = setTimeout(() => {
+      options.log?.("\u5173\u95ED\u8D85\u65F6\uFF0C\u5F3A\u5236\u9000\u51FA\u3002");
+      exit(1);
+    }, timeoutMs);
+    timer.unref?.();
+    runCleanup();
+  };
+  const installed = [];
+  for (const signal of shutdownSignals(proc.platform)) {
+    try {
+      proc.on(signal, onSignal);
+      installed.push(signal);
+    } catch {}
+  }
+  return {
+    signal: controller.signal,
+    setCleanup(next) {
+      cleanup = next;
+      if (controller.signal.aborted)
+        runCleanup();
+    },
+    dispose() {
+      clearTimeout(timer);
+      for (const signal of installed)
+        proc.off(signal, onSignal);
+    }
+  };
+}
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 5000;
+
 // packages/gateway/src/index.ts
 var init_src2 = __esm(() => {
   init_client();
@@ -41199,13 +41780,13 @@ var init_src2 = __esm(() => {
 
 // packages/tui/src/gateway.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { basename as basename7, dirname as dirname11, join as join14 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { basename as basename7, dirname as dirname11, join as join15 } from "path";
 async function connectToGateway(options = {}) {
   const config = loadNekoConfig(options.configDir);
   const storagePath = options.storagePath ?? config.storagePath ?? DEFAULT_STORAGE_PATH;
   const nekoDir = dirname11(storagePath);
-  const fileServerId = readServerId(join14(nekoDir, SERVER_ID_FILENAME2));
+  const fileServerId = readServerId(join15(nekoDir, SERVER_ID_FILENAME2));
   const platform = options.platform ?? process.platform;
   if (platform === "win32") {
     if (fileServerId !== undefined) {
@@ -41222,8 +41803,8 @@ async function connectToGateway(options = {}) {
     }
     return spawnAndConnect({ ...options, platform, storagePath, socketPath: undefined, nekoDir, fileServerId });
   }
-  const socketPath = options.socketPath ?? config.gateway?.socketPath ?? (fileServerId !== undefined ? join14(nekoDir, `${fileServerId}.sock`) : undefined);
-  const serverIdFor = (path) => fileServerId ?? serverIdFromSocketPath2(path) ?? readServerId(join14(nekoDir, SERVER_ID_FILENAME2));
+  const socketPath = options.socketPath ?? config.gateway?.socketPath ?? (fileServerId !== undefined ? join15(nekoDir, `${fileServerId}.sock`) : undefined);
+  const serverIdFor = (path) => fileServerId ?? serverIdFromSocketPath2(path) ?? readServerId(join15(nekoDir, SERVER_ID_FILENAME2));
   if (socketPath !== undefined && existsSync3(socketPath)) {
     const serverId = serverIdFor(socketPath);
     if (serverId !== undefined) {
@@ -41257,7 +41838,7 @@ async function connectSpawned(plan, child, outputTail, spawnError) {
   const timeoutMs = plan.spawnTimeoutMs ?? 20000;
   if (plan.platform === "win32") {
     const timeoutAt = Date.now() + timeoutMs;
-    const serverId = plan.fileServerId ?? await waitForValue2(() => readServerId(join14(plan.nekoDir, SERVER_ID_FILENAME2)), "gateway serverId file", timeoutMs, child, outputTail, spawnError);
+    const serverId = plan.fileServerId ?? await waitForValue2(() => readServerId(join15(plan.nekoDir, SERVER_ID_FILENAME2)), "gateway serverId file", timeoutMs, child, outputTail, spawnError);
     let lastError = new Error("Gateway port file unavailable");
     while (Date.now() < timeoutAt) {
       if (child.exitCode !== null || child.signalCode !== null || spawnError() !== undefined) {
@@ -41294,11 +41875,11 @@ async function connectSpawned(plan, child, outputTail, spawnError) {
   }
   let socketPath = plan.socketPath;
   if (socketPath === undefined) {
-    const generated = await waitForValue2(() => readServerId(join14(plan.nekoDir, SERVER_ID_FILENAME2)), "gateway serverId file", timeoutMs, child, outputTail, spawnError);
-    socketPath = join14(plan.nekoDir, `${generated}.sock`);
+    const generated = await waitForValue2(() => readServerId(join15(plan.nekoDir, SERVER_ID_FILENAME2)), "gateway serverId file", timeoutMs, child, outputTail, spawnError);
+    socketPath = join15(plan.nekoDir, `${generated}.sock`);
   }
   await waitForValue2(() => existsSync3(socketPath) ? true : undefined, `gateway ready (socket: ${socketPath})`, timeoutMs, child, outputTail, spawnError);
-  const serverId = plan.fileServerId ?? serverIdFromSocketPath2(socketPath) ?? readServerId(join14(plan.nekoDir, SERVER_ID_FILENAME2));
+  const serverId = plan.fileServerId ?? serverIdFromSocketPath2(socketPath) ?? readServerId(join15(plan.nekoDir, SERVER_ID_FILENAME2));
   if (serverId === undefined) {
     throw new Error(`Cannot determine gateway serverId (socket: ${socketPath})`);
   }
@@ -41350,7 +41931,7 @@ function gatewayArgs(plan) {
 }
 function readServerId(file) {
   try {
-    const value = readFileSync2(file, "utf8").trim();
+    const value = readFileSync3(file, "utf8").trim();
     return isServerId(value) ? value : undefined;
   } catch {
     return;
@@ -41554,7 +42135,7 @@ var init_help_ui = __esm(() => {
 });
 
 // packages/tui/src/image-input.ts
-import { execFile as execFile2 } from "child_process";
+import { execFile as execFile3 } from "child_process";
 import { readFile as readFile9, stat as stat5 } from "fs/promises";
 import { homedir as homedir8 } from "os";
 import { basename as basename8, resolve as resolve5 } from "path";
@@ -41657,7 +42238,7 @@ function isClipboardShortcut(data, platform = process.platform) {
 }
 var exec;
 var init_image_input = __esm(() => {
-  exec = promisify2(execFile2);
+  exec = promisify2(execFile3);
 });
 
 // packages/tui/src/layout.ts
@@ -43648,12 +44229,12 @@ var init_main = __esm(async () => {
 });
 
 // packages/web/src/open-browser.ts
-import { execFile as execFile3 } from "child_process";
+import { execFile as execFile4 } from "child_process";
 function openBrowser(url) {
   const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32.exe" : "xdg-open";
   const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
   return new Promise((resolve, reject) => {
-    execFile3(command, args, { timeout: 8000, windowsHide: true }, (error) => {
+    execFile4(command, args, { timeout: 8000, windowsHide: true }, (error) => {
       if (error)
         reject(error);
       else
@@ -43667,7 +44248,7 @@ var init_open_browser = () => {};
 import { spawn as spawn4 } from "child_process";
 import { randomUUID as randomUUID6 } from "crypto";
 import { mkdir as mkdir8, readFile as readFile10, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname12, join as join15 } from "path";
+import { dirname as dirname12, join as join16 } from "path";
 async function ensureNekoGateway(options) {
   const timeoutMs = options.spawnTimeoutMs ?? 30000;
   const timeoutAt = Date.now() + timeoutMs;
@@ -43678,6 +44259,7 @@ async function ensureNekoGateway(options) {
     if (discovered !== undefined && await probeWs(discovered, serverId, timeoutAt)) {
       return makeHandle(serverId, undefined, discovered, null, nekoDir);
     }
+    throwIfAborted(options.signal);
     const child = spawnGatewayProcess(options, null, serverId);
     pipeChildLogs(child, options.onLog);
     let spawnError;
@@ -43687,6 +44269,7 @@ async function ensureNekoGateway(options) {
     try {
       let lastError = new Error("gateway \u672A\u5C31\u7EEA");
       while (Date.now() < timeoutAt) {
+        throwIfAborted(options.signal);
         if (spawnError !== undefined)
           throw spawnError;
         if (child.exitCode !== null || child.signalCode !== null) {
@@ -43703,7 +44286,7 @@ async function ensureNekoGateway(options) {
             lastError = error;
           }
         }
-        await sleep2(Math.max(0, Math.min(PROBE_INTERVAL_MS, timeoutAt - Date.now())));
+        await sleep2(Math.max(0, Math.min(PROBE_INTERVAL_MS, timeoutAt - Date.now())), options.signal);
       }
       throw new Error(`\u7B49\u5F85 neko gateway \u5C31\u7EEA\u8D85\u65F6\uFF08${options.spawnTimeoutMs ?? 30000}ms\uFF09\uFF1A${lastError instanceof Error ? lastError.message : String(lastError)}`);
     } catch (error) {
@@ -43711,7 +44294,7 @@ async function ensureNekoGateway(options) {
       throw error;
     }
   }
-  const socketPath = options.socketPath ?? join15(nekoDir, `${serverId}.sock`);
+  const socketPath = options.socketPath ?? join16(nekoDir, `${serverId}.sock`);
   const host = options.host ?? "127.0.0.1";
   const port = options.port ?? 8321;
   const wsUrl = `ws://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}:${port}`;
@@ -43721,6 +44304,7 @@ async function ensureNekoGateway(options) {
     }
     return makeHandle(serverId, socketPath, wsUrl, null, nekoDir);
   }
+  throwIfAborted(options.signal);
   const child = spawnGatewayProcess(options, socketPath, serverId);
   pipeChildLogs(child, options.onLog);
   let spawnError;
@@ -43730,6 +44314,7 @@ async function ensureNekoGateway(options) {
   try {
     let lastError = new Error("gateway \u672A\u5C31\u7EEA");
     while (Date.now() < timeoutAt) {
+      throwIfAborted(options.signal);
       if (spawnError !== undefined)
         throw spawnError;
       if (child.exitCode !== null || child.signalCode !== null) {
@@ -43744,7 +44329,7 @@ async function ensureNekoGateway(options) {
           throw error;
         lastError = error;
       }
-      await sleep2(Math.max(0, Math.min(PROBE_INTERVAL_MS, timeoutAt - Date.now())));
+      await sleep2(Math.max(0, Math.min(PROBE_INTERVAL_MS, timeoutAt - Date.now())), options.signal);
     }
     throw new Error(`\u7B49\u5F85 neko gateway \u5C31\u7EEA\u8D85\u65F6\uFF08${options.spawnTimeoutMs ?? 30000}ms\uFF09\uFF1A${lastError instanceof Error ? lastError.message : String(lastError)}`);
   } catch (error) {
@@ -43831,7 +44416,7 @@ function makeHandle(serverId, socketPath, wsUrl, spawned, nekoDir) {
   };
 }
 async function loadOrCreateServerId2(nekoDir) {
-  const file = join15(nekoDir, SERVER_ID_FILENAME3);
+  const file = join16(nekoDir, SERVER_ID_FILENAME3);
   try {
     const existing = (await readFile10(file, "utf8")).trim();
     if (existing !== "")
@@ -43843,8 +44428,22 @@ async function loadOrCreateServerId2(nekoDir) {
 `, { mode: 384 });
   return created;
 }
-function sleep2(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function throwIfAborted(signal) {
+  if (signal?.aborted)
+    throw new Error("neko gateway \u542F\u52A8\u88AB\u4E2D\u65AD");
+}
+function sleep2(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted)
+      return resolve();
+    const timer = setTimeout(done, ms);
+    function done() {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done);
+      resolve();
+    }
+    signal?.addEventListener("abort", done, { once: true });
+  });
 }
 var SERVER_ID_FILENAME3 = "gateway-server-id", PROBE_INTERVAL_MS = 400, PROBE_TIMEOUT_MS = 5000;
 var init_gateway_spawn = __esm(() => {
@@ -43855,7 +44454,7 @@ var init_gateway_spawn = __esm(() => {
 // packages/web/src/mobile-admin.ts
 import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual3 } from "crypto";
 import { ChordError as ChordError7, createHost as createHost4 } from "@earendil-works/chord";
-function createMobileAdminCaller(gateway, nekoDir) {
+function createMobileAdminCaller(gateway, nekoDir, timeouts = {}) {
   const serverId = gateway.serverId;
   let tokenPromise;
   const readToken = () => {
@@ -43865,10 +44464,18 @@ function createMobileAdminCaller(gateway, nekoDir) {
     });
     return tokenPromise;
   };
-  return async (method, params) => {
+  const run = async (method, params, signal) => {
     const token = await readToken();
+    signal.throwIfAborted();
     const link = gateway.socketPath !== undefined ? await createUnixLink(gateway.socketPath) : createWsLink(gateway.wsUrl);
     const host = createHost4({ kind: "client", upstream: identifiedLink(link, serverId), onError: () => {} });
+    const release = () => {
+      host.close().catch(() => {
+        return;
+      });
+      link.close("aborted");
+    };
+    signal.addEventListener("abort", release, { once: true });
     try {
       const admin = host.get(NekoMobileAdmin, { token }, { at: serverId });
       const call = admin[method];
@@ -43884,12 +44491,42 @@ function createMobileAdminCaller(gateway, nekoDir) {
         admin.release?.();
       }
     } finally {
+      signal.removeEventListener("abort", release);
       await host.close().catch(() => {
         return;
       });
       link.close("done");
     }
   };
+  const inflight = new Set;
+  const caller = async (method, params) => {
+    const timeoutMs = method === "enable" ? timeouts.enableTimeoutMs ?? MOBILE_ADMIN_ENABLE_TIMEOUT_MS : timeouts.callTimeoutMs ?? MOBILE_ADMIN_CALL_TIMEOUT_MS;
+    const controller = new AbortController;
+    inflight.add(controller);
+    const timer = setTimeout(() => controller.abort(new MobileAdminTimeoutError(method, timeoutMs)), timeoutMs);
+    try {
+      const work = run(method, params, controller.signal);
+      work.catch(() => {
+        return;
+      });
+      return await new Promise((resolve, reject) => {
+        const onAbort = () => reject(controller.signal.reason);
+        if (controller.signal.aborted)
+          onAbort();
+        else
+          controller.signal.addEventListener("abort", onAbort, { once: true });
+        work.then(resolve, reject);
+      });
+    } finally {
+      clearTimeout(timer);
+      inflight.delete(controller);
+    }
+  };
+  caller.abortAll = () => {
+    for (const controller of [...inflight])
+      controller.abort(new MobileAdminAbortedError);
+  };
+  return caller;
 }
 function writeJson(response, status, body) {
   response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
@@ -43966,7 +44603,7 @@ async function handleMobileAdminRequest(request, response, context) {
       if (error instanceof GatewayUnsupportedError)
         supported = false;
       else
-        throw error;
+        return respondWithCaller(response, Promise.reject(error));
     }
     writeJson(response, 200, { csrf: context.csrf, supported });
     return true;
@@ -44024,6 +44661,14 @@ async function respondWithCaller(response, result) {
       writeJson(response, 502, { code: error.code, message: error.message });
       return true;
     }
+    if (error instanceof MobileAdminTimeoutError) {
+      writeJson(response, 504, { code: "gateway_timeout", message: error.message });
+      return true;
+    }
+    if (error instanceof MobileAdminAbortedError) {
+      writeJson(response, 503, { code: "shutting_down", message: error.message });
+      return true;
+    }
     throw error;
   }
   return true;
@@ -44041,7 +44686,7 @@ function createMobileAdminContext(options) {
     allowedHosts: hosts
   };
 }
-var BODY_LIMIT_BYTES = 4096, GatewayUnsupportedError, WRITE_ROUTES, READ_ROUTES;
+var BODY_LIMIT_BYTES = 4096, GatewayUnsupportedError, MobileAdminTimeoutError, MobileAdminAbortedError, MOBILE_ADMIN_CALL_TIMEOUT_MS = 1e4, MOBILE_ADMIN_ENABLE_TIMEOUT_MS = 30000, WRITE_ROUTES, READ_ROUTES;
 var init_mobile_admin = __esm(() => {
   init_src2();
   GatewayUnsupportedError = class GatewayUnsupportedError extends Error {
@@ -44050,6 +44695,18 @@ var init_mobile_admin = __esm(() => {
       this.name = "GatewayUnsupportedError";
     }
   };
+  MobileAdminTimeoutError = class MobileAdminTimeoutError extends Error {
+    constructor(method, timeoutMs) {
+      super(`mobile admin call "${method}" timed out after ${timeoutMs}ms`);
+      this.name = "MobileAdminTimeoutError";
+    }
+  };
+  MobileAdminAbortedError = class MobileAdminAbortedError extends Error {
+    constructor() {
+      super("mobile admin call was cancelled because the web server is shutting down");
+      this.name = "MobileAdminAbortedError";
+    }
+  };
   WRITE_ROUTES = {
     "/api/mobile/enable": "enable",
     "/api/mobile/disable": "disable",
@@ -44075,9 +44732,11 @@ async function startWebServer(options = {}) {
   const storagePath = options.gateway?.storagePath ?? DEFAULT_STORAGE_PATH;
   const gateway = await ensureNekoGateway({
     ...options.gateway ?? {},
-    storagePath
+    storagePath,
+    ...options.signal !== undefined ? { signal: options.signal } : {}
   });
   let mobileAdmin;
+  let closing;
   const server = createServer3((request, response) => {
     const context = mobileAdmin;
     if (context === undefined) {
@@ -44098,12 +44757,24 @@ async function startWebServer(options = {}) {
       response.end(error instanceof Error ? error.message : String(error));
     });
   });
+  const sockets = new Set;
+  server.on("connection", (socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+  });
   const port = options.port ?? DEFAULT_PORT2;
   const host = options.host ?? DEFAULT_HOST2;
-  await new Promise((resolveListen, rejectListen) => {
-    server.once("error", rejectListen);
-    server.listen(port, host, resolveListen);
-  });
+  try {
+    await new Promise((resolveListen, rejectListen) => {
+      server.once("error", rejectListen);
+      server.listen(port, host, resolveListen);
+    });
+  } catch (error) {
+    await gateway.close().catch(() => {
+      return;
+    });
+    throw error;
+  }
   const address = server.address();
   const actualPort = typeof address === "object" && address !== null ? address.port : port;
   mobileAdmin = createMobileAdminContext({
@@ -44116,11 +44787,16 @@ async function startWebServer(options = {}) {
     url: `http://${host === "0.0.0.0" ? "127.0.0.1" : host === "::" ? "[::1]" : host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}:${actualPort}`,
     port: actualPort,
     gateway,
-    async close() {
-      await new Promise((resolveClose, rejectClose) => {
-        server.close((error) => error ? rejectClose(error) : resolveClose());
-      });
-      await gateway.close();
+    close() {
+      closing ??= (async () => {
+        mobileAdmin?.caller.abortAll?.();
+        const closed = new Promise((resolveClose) => server.close(() => resolveClose()));
+        for (const socket of sockets)
+          socket.destroy();
+        await closed;
+        await gateway.close();
+      })();
+      return closing;
     }
   };
 }
@@ -44342,13 +45018,22 @@ var USAGE2 = `\u7528\u6CD5: neko web [\u9009\u9879]
   --no-open            \u4E0D\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF08\u9002\u7528\u4E8E\u8FDC\u7A0B\u6216\u65E0\u684C\u9762\u73AF\u5883\uFF09
   -h, --help           \u663E\u793A\u6B64\u5E2E\u52A9
 
-\u53EF\u5728 Web \u8BBE\u7F6E\u9875\u914D\u7F6E Key\uFF1B\u7F51\u5173\u5B50\u8FDB\u7A0B\u4E5F\u4F1A\u7EE7\u627F DEEPSEEK_API_KEY\u3002`;
+\u53EF\u5728 Web \u8BBE\u7F6E\u9875\u914D\u7F6E Key\uFF1B\u7F51\u5173\u5B50\u8FDB\u7A0B\u4E5F\u4F1A\u7EE7\u627F DEEPSEEK_API_KEY\u3002`, server, shutdown;
 var init_main2 = __esm(async () => {
+  init_src2();
   init_open_browser();
   init_server();
+  shutdown = installShutdown({
+    log: (message) => console.log(message),
+    exit: (code) => {
+      server?.gateway.spawned?.kill("SIGKILL");
+      process.exit(code);
+    }
+  });
   try {
     const options = parseArgs2(process.argv.slice(2));
-    const server = await startWebServer({
+    server = await startWebServer({
+      signal: shutdown.signal,
       ...options.port !== undefined ? { port: options.port } : {},
       ...options.host !== undefined ? { host: options.host } : {},
       gateway: {
@@ -44361,27 +45046,23 @@ var init_main2 = __esm(async () => {
         onLog: (line) => console.log(`[gateway] ${line}`)
       }
     });
-    console.log(`[web] neko web \u5DF2\u542F\u52A8: ${server.url}`);
-    console.log(`[web]   gateway: ${server.gateway.wsUrl}\uFF08serverId: ${server.gateway.serverId}\uFF09`);
+    const running = server;
+    shutdown.setCleanup(() => running.close());
+    console.log(`[web] neko web \u5DF2\u542F\u52A8: ${running.url}`);
+    console.log(`[web]   gateway: ${running.gateway.wsUrl}\uFF08serverId: ${running.gateway.serverId}\uFF09`);
     console.log("[web] \u6309 Ctrl+C \u505C\u6B62\u3002");
-    const shutdown = () => {
-      console.log(`
-\u6B63\u5728\u5173\u95ED\u2026`);
-      server.close().then(() => process.exit(0)).catch((error) => {
-        console.error(error instanceof Error ? error.message : String(error));
-        process.exit(1);
-      });
-    };
-    process.on("SIGINT", shutdown);
-    process.on("SIGTERM", shutdown);
     if (options.open) {
-      openBrowser(server.url).catch(() => {
-        console.warn(`\u65E0\u6CD5\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF0C\u8BF7\u624B\u52A8\u8BBF\u95EE: ${server.url}`);
+      openBrowser(running.url).catch(() => {
+        console.warn(`\u65E0\u6CD5\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF0C\u8BF7\u624B\u52A8\u8BBF\u95EE: ${running.url}`);
       });
     }
   } catch (error) {
+    if (shutdown.signal.aborted) {
+      process.exit(0);
+    }
     console.error(error instanceof Error ? error.message : String(error));
     process.exitCode = 1;
+    shutdown.dispose();
   }
 });
 
@@ -44489,15 +45170,7 @@ var GATEWAY_USAGE = `\u7528\u6CD5: neko serve [\u9009\u9879]
 \u53EF\u901A\u8FC7\u524D\u7AEF\u8BBE\u7F6E\u6216 DEEPSEEK_API_KEY \u914D\u7F6E\u51ED\u636E\u3002`;
 
 // packages/gateway/src/main.ts
-var argv, options, gateway, stopping = false, stop = () => {
-  if (stopping)
-    return;
-  stopping = true;
-  gateway.close().then(() => process.exit(0)).catch((error) => {
-    console.error("\u5173\u95ED\u5931\u8D25:", error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  });
-};
+var argv, shutdown2, options, gateway;
 var init_main3 = __esm(async () => {
   init_gateway();
   argv = process.argv.slice(2);
@@ -44505,6 +45178,10 @@ var init_main3 = __esm(async () => {
     console.log(GATEWAY_USAGE);
     process.exit(0);
   }
+  shutdown2 = installShutdown({
+    log: (message) => console.log(message),
+    exit: (code) => process.exit(code)
+  });
   options = parseGatewayArgs(argv);
   gateway = await startGateway({
     ...options,
@@ -44516,8 +45193,7 @@ var init_main3 = __esm(async () => {
   if (gateway.wsUrl !== undefined)
     console.log(`  WebSocket:   ${gateway.wsUrl}`);
   console.log("\u6309 Ctrl+C \u505C\u6B62\u3002");
-  process.on("SIGINT", stop);
-  process.on("SIGTERM", stop);
+  shutdown2.setCleanup(() => gateway.close());
 });
 
 // packages/cli/src/main.ts